CVE-2019-10912: sensiolabs symfony Deserialization of Untrusted Data
Vulnerability summary
CVE-2019-10912 is a high (CVSS 7.1) Deserialization of Untrusted Data vulnerability in sensiolabs symfony. EPSS estimates a 2.26% chance of exploitation in the next 30 days, higher than 82.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 16-05-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
EPSS trend
Probability
2.26%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
0.00 pp
From 2.26% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- symfony< 3.4.22+dfsg-2
Sensiolabs1 product
- symfony≥ 2.8.0, < 2.8.50 | ≥ 3.4.0, < 3.4.26 | ≥ 4.1.0, < 4.1.12 | ≥ 4.2.0, < 4.2.7
Ubuntu1 product
- symfonyAll versions (No fix recorded)
3 vendors · 3 products
References
16 links- symfony.com/blog/cve-2019-10912-prevent-destructors-with-side-effects-from-being-unserializedX Refsource CONFIRMThird Party AdvisoryREPORT
Show all 16 references
- github.com/symfony/symfony/commit/4fb975281634b8d49ebf013af9e502e67c28816bX Refsource CONFIRMPatchThird Party Advisory
- typo3.org/security/advisory/typo3-core-sa-2019-016/X Refsource CONFIRM